Privacy Policy

1. Who we are

The Exam Brief is operated by The Exam Brief, a proprietorship of Sahras Khan, at F 274 A, Second Floor, Shaheen Bagh, Jamia Nagar, Okhla, Abul Fazal Enclave Part II, New Delhi, South East Delhi, Delhi 110025, India. For the purposes of the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) we are the Data Fiduciary responsible for your personal data, and you are the Data Principal. We also comply with the Information Technology Act, 2000 and the rules made under it.

You can reach us at admin@theexambrief.com. Our grievance officer is named in Section 12.

2. Data we collect

• Account data — your name and email address when you register, and authentication data needed to keep you signed in.
• Usage and practice data — your quiz attempts, scores, progress, highlights, notes, and which study notes you view, so we can show your performance and strengths and weaknesses.
• Device data — a device identifier and basic browser and user-agent information, used to enforce our account device limit and to keep your account secure.
• Payment data — we receive confirmation of your payment, the plan purchased, and a transaction reference from our payment gateway. We do not collect or store your full card, UPI, or bank details.
• Communications — messages you send us for support, billing, or grievances, including over email or WhatsApp where offered.
• Technical and analytics data — limited information such as approximate location derived from IP address, pages visited, and performance metrics, collected to operate, secure, and improve the Platform.

We do not knowingly collect sensitive categories of data such as health, biometric, financial account, or caste and religion data. Please do not send such information to us in support messages.

3. How we use your data, and our legal basis

Under the DPDP Act we process your personal data either with your consent, given when you create an account and accept this policy, or for the legitimate uses that Act permits, such as complying with a legal obligation. Specifically, we use your data:

• to create and manage your account and provide access to the Content;
• to process purchases, confirm payments, and manage access periods and renewals;
• to show your practice history, progress, and recommendations;
• to enforce our device limit and protect against account sharing, fraud, and abuse;
• to respond to your support requests and grievances;
• to send essential service messages, for example password resets and account, access, or billing notices;
• to maintain, secure, and improve the Platform, and to comply with legal, tax, and accounting obligations.

We do not use your data for automated decision-making that produces legal effects, and we do not sell your personal data.

4. Service providers we share data with

We use trusted third parties, acting as our Data Processors, to run the Platform. We share only what is necessary, and they are bound by contract to protect your data and to use it only on our instructions:

• Supabase — authentication and database hosting (account, progress, and device data).
• Razorpay (Razorpay Software Private Limited) — payment processing. Your payment details are collected and handled directly by Razorpay under its own privacy policy.
• Vercel — website hosting, delivery, and performance analytics.
• Resend — transactional email delivery. We may change our email provider; this policy will be updated when we do.

We may also disclose data where required by law or a valid order of a court or authority, to enforce our terms, or to protect the rights, safety, and security of our users or the Platform. If we ever transfer the business, your data may transfer with it, subject to this policy.

5. Storage outside India

Some of the providers listed above operate infrastructure outside India. This means your personal data may be stored or processed on servers located in other countries. Where that happens, we rely on providers that offer contractual and technical safeguards, and we transfer only to countries not restricted by the Central Government under the DPDP Act.

6. Cookies and similar technologies

We use cookies and similar local-storage technologies that are necessary for the Platform to function, for example to keep you signed in, to remember your device for the device limit, and to hold your session securely. We may also use limited analytics to understand how the Platform is used. You can control cookies through your browser settings, but disabling essential cookies will stop parts of the Platform from working.

7. Data retention

We keep your personal data for as long as your account is active. After your account is closed or your access period ends without renewal, we retain data only as long as needed for legal, accounting, tax, or security purposes, typically up to eight years for records connected to a financial transaction, as required under Indian tax law. When data is no longer needed we delete or anonymise it.

8. Security

We use reasonable technical and organisational measures to protect your data, including access controls, encryption in transit, hashed credentials, and row-level security on our database. No method of transmission or storage is fully secure, however, and we cannot guarantee absolute security.

9. Data breach notification

If a personal data breach occurs, we will notify affected users and the Data Protection Board of India without undue delay, in the manner and within the timelines required by the DPDP Act and the rules made under it.

10. Your rights

As a Data Principal you have the right to:

• Access — obtain a summary of the personal data we process about you and the processing activities involved.
• Correction and completion — have inaccurate or incomplete data corrected, completed, or updated.
• Erasure — ask us to delete your personal data, unless we are required to retain it by law.
• Withdraw consent — withdraw consent at any time, as easily as it was given. Withdrawal does not affect processing already carried out, and may mean we can no longer provide the service.
• Grievance redressal — raise a complaint with our grievance officer, as set out in Section 12.
• Nomination — nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, write to admin@theexambrief.com from your registered email address. We may need to verify your identity before acting on a request, and we will respond within the timelines required by law.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

11. Your responsibilities

The DPDP Act also places duties on Data Principals. You agree to provide accurate information, not to impersonate another person, not to suppress material information when providing personal data, and not to raise false or frivolous grievances.

12. Grievance officer

If you have a question, concern, or complaint about how we handle your personal data, contact:

Umar Khan, Grievance Officer
Email: admin@theexambrief.com
F 274 A, Second Floor, Shaheen Bagh, Jamia Nagar, Okhla, Abul Fazal Enclave Part II, New Delhi, South East Delhi, Delhi 110025, India

Support hours are Monday to Saturday, 10:00 to 18:00 IST (excluding public holidays). We acknowledge grievances within 48 hours and aim to resolve them within 30 days of receipt.

13. Children

The Platform is intended for users preparing for postgraduate-level psychology examinations and is not directed at children. Under the DPDP Act a child is anyone under 18 years of age. We do not knowingly collect the personal data of a child without verifiable parental consent, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children. If you believe a child has provided us with personal data, contact our grievance officer and we will delete it.

14. Changes to this policy

We may update this policy from time to time. We will revise the “Last updated” date above and, where changes are material, take reasonable steps to notify you.

15. Contact

For any privacy question or rights request, email admin@theexambrief.com or use our Contact page. Legal notices may also be sent to the registered business address above.